oauth-token check #1
trs
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
token jedes mal (zumindest beim Aufruf der Hauptseite) checken, nicht nur nach gültigem Session-Cookie prüfen.
Api-Calls können auch nur mit gültigem Session-Cookie erfolgen. Nochmal nachdenken bzgl. security
in PHP in etwa so:
-// check if user is logged in
-if (isset($_SESSION['id_token'])) {
+// check if user is logged in UND das Token noch gültig ist (exp-Claim).
+// Eine bloß vorhandene Session reicht nicht - sie kann die tatsächliche
+// Token-Gültigkeit bei Authentik bereits überlebt haben.
+if (isset($_SESSION['id_token']) && !isTokenExpired($_SESSION['id_token'])) {
header('Location: card.php');
/echo "Willkommen,";
echo '
Ausweis anzeigen';
echo '
Ausweis download (pdf)';
echo '
Abmelden';/
} else {
Die Ablaufprüfung ist umgesetzt: oidc.py akzeptiert Benutzer-Claims nur, wenn eine gültige, noch nicht abgelaufene expires_at-Zeit in der Session liegt. Abgelaufene oder unvollständige Auth-Daten werden entfernt; ein laufender OIDC-Login bleibt erhalten. Hauptseite und geschützte APIs verwenden diesen zentralen Check. Der Callback speichert expires_at bereits im aktuellen HEAD in auth.py.
Wichtig: Eine externe Keycloak-Abmeldung wird mit dieser Ablaufprüfung spätestens beim Ablauf des Access-Tokens erkannt, nicht zwingend sofort. Für sofortige Invalidierung wären etwa Token-Introspection oder ein OIDC-Logout-Callback mit sicherer serverseitiger Tokenablage nötig.
Erstmal testen und dann weiter schauen
=== MaßnahmenMonitor ===
Projekt: /var/www/mm
Git aktualisieren...
Bereits aktuell.
Python-Abhängigkeiten aktualisieren...
Requirement already satisfied: fastapi in ./.venv/lib/python3.13/site-packages (from -r /var/www/mm/requirements.txt (line 1)) (0.141.1)
Requirement already satisfied: uvicorn in ./.venv/lib/python3.13/site-packages (from -r /var/www/mm/requirements.txt (line 2)) (0.54.0)
Requirement already satisfied: authlib in ./.venv/lib/python3.13/site-packages (from -r /var/www/mm/requirements.txt (line 3)) (1.8.0)
Requirement already satisfied: httpx in ./.venv/lib/python3.13/site-packages (from -r /var/www/mm/requirements.txt (line 4)) (0.28.1)
Requirement already satisfied: itsdangerous in ./.venv/lib/python3.13/site-packages (from -r /var/www/mm/requirements.txt (line 5)) (2.2.0)
Requirement already satisfied: starlette>=0.46.0 in ./.venv/lib/python3.13/site-packages (from fastapi->-r /var/www/mm/requirements.txt (line 1)) (1.7.0)
Requirement already satisfied: pydantic>=2.9.0 in ./.venv/lib/python3.13/site-packages (from fastapi->-r /var/www/mm/requirements.txt (line 1)) (2.13.5)
Requirement already satisfied: typing-extensions>=4.8.0 in ./.venv/lib/python3.13/site-packages (from fastapi->-r /var/www/mm/requirements.txt (line 1)) (4.16.0)
Requirement already satisfied: typing-inspection>=0.4.2 in ./.venv/lib/python3.13/site-packages (from fastapi->-r /var/www/mm/requirements.txt (line 1)) (0.4.4)
Requirement already satisfied: annotated-doc>=0.0.2 in ./.venv/lib/python3.13/site-packages (from fastapi->-r /var/www/mm/requirements.txt (line 1)) (0.0.5)
Requirement already satisfied: click>=7.0 in ./.venv/lib/python3.13/site-packages (from uvicorn->-r /var/www/mm/requirements.txt (line 2)) (8.5.0)
Requirement already satisfied: h11>=0.8 in ./.venv/lib/python3.13/site-packages (from uvicorn->-r /var/www/mm/requirements.txt (line 2)) (0.16.0)
Requirement already satisfied: cryptography>=45.0.1 in ./.venv/lib/python3.13/site-packages (from authlib->-r /var/www/mm/requirements.txt (line 3)) (50.0.1)
Requirement already satisfied: joserfc>=1.6.1 in ./.venv/lib/python3.13/site-packages (from authlib->-r /var/www/mm/requirements.txt (line 3)) (1.7.5)
Requirement already satisfied: anyio in ./.venv/lib/python3.13/site-packages (from httpx->-r /var/www/mm/requirements.txt (line 4)) (4.15.1)
Requirement already satisfied: certifi in ./.venv/lib/python3.13/site-packages (from httpx->-r /var/www/mm/requirements.txt (line 4)) (2026.7.22)
Requirement already satisfied: httpcore==1.* in ./.venv/lib/python3.13/site-packages (from httpx->-r /var/www/mm/requirements.txt (line 4)) (1.0.9)
Requirement already satisfied: idna in ./.venv/lib/python3.13/site-packages (from httpx->-r /var/www/mm/requirements.txt (line 4)) (3.20)
Requirement already satisfied: cffi>=2.0.0 in ./.venv/lib/python3.13/site-packages (from cryptography>=45.0.1->authlib->-r /var/www/mm/requirements.txt (line 3)) (2.1.1)
Requirement already satisfied: pycparser in ./.venv/lib/python3.13/site-packages (from cffi>=2.0.0->cryptography>=45.0.1->authlib->-r /var/www/mm/requirements.txt (line 3)) (3.0)
Requirement already satisfied: annotated-types>=0.6.0 in ./.venv/lib/python3.13/site-packages (from pydantic>=2.9.0->fastapi->-r /var/www/mm/requirements.txt (line 1)) (0.8.0)
Requirement already satisfied: pydantic-core==2.46.5 in ./.venv/lib/python3.13/site-packages (from pydantic>=2.9.0->fastapi->-r /var/www/mm/requirements.txt (line 1)) (2.46.5)
Kein laufender MaßnahmenMonitor-Prozess gefunden.
Starte MaßnahmenMonitor mit den Einstellungen aus config/config.py...
FEHLER: MaßnahmenMonitor konnte nicht gestartet werden. Letzte Logzeilen:
Traceback (most recent call last):
File "/var/www/mm/main.py", line 9, in
from app.auth import router as auth_router
File "/var/www/mm/app/auth.py", line 4, in
from app.oidc import get_session_user, oauth
File "/var/www/mm/app/oidc.py", line 30
<<<<<<< HEAD
^^
SyntaxError: invalid syntax